Split tunneling
Also known as: split tunnel, split tunneling, VPN split tunnel, full tunnel
Split tunneling is a VPN setting that routes only traffic destined for company resources through the encrypted tunnel, while everyday internet traffic (streaming, general browsing) goes directly out.
It improves performance and reduces load, but must be configured carefully so it doesn't bypass important security controls.
Split tunneling, explained at three levels
At home
Split tunneling is like a mail sorter at your door. Letters addressed to the office go into a locked courier bag that travels straight to headquarters. Everything else, such as personal mail, goes out through the regular post. With a VPN, your computer does this sorting: traffic headed to company systems goes through the encrypted tunnel, and everything else, like streaming or general browsing, goes straight to the internet.
At work
Split tunneling is a VPN setting that sends only company-bound traffic through the encrypted VPN, while other internet traffic goes out directly from the user's own connection. For a business, it reduces the load on the office internet line and VPN gateway and makes video calls and cloud apps faster for remote staff. The trade-off is that direct traffic skips the security tools at the office.
At home
The VPN software on your computer installs a routing table, a list that says where each destination's traffic should go. In full tunnel mode, the list says everything goes through the VPN. In split tunnel mode, only certain addresses, such as the office network's ranges, use the tunnel, and the rest use your home connection. Inverse split tunneling flips this: everything uses the tunnel except listed services, such as Microsoft 365 or Zoom.
At work
For a workplace, the main reason for split tunneling is that most traffic now goes to cloud services, not the office. Sending a remote worker's Teams call to the office and back out again adds delay and doubles the office bandwidth used. Microsoft publishes a list of Microsoft 365 addresses marked Optimize that it recommends sending directly rather than through the VPN. The cost is that directly routed traffic misses the office firewall and web filter.
At home
Split tunneling can be set by destination address, by domain name, or by application, such as letting only the browser and Teams go direct. Domain rules are convenient but tricky, because cloud services change addresses often. The real trade-off is visibility: anything outside the tunnel is invisible to company inspection. While full tunnels feel safer, in my view split tunneling is fine as long as the laptop itself carries its own protection.
At work
Modern designs pair split tunneling with endpoint-centric security: EDR on the device, DNS filtering that works off-network, and cloud web gateways, so leaving the tunnel does not mean leaving protection. This matches SASE and ZTNA thinking, where security follows the user rather than relying on backhauling all traffic to a data centre. Risks include misconfigured routes that leak internal traffic, and attacks such as TunnelVision in 2024, which abused DHCP to pull traffic out of VPN tunnels.
Real-world examples
At home
Thomas's video calls were choppy because his old VPN routed everything, including the video, through the office. Enabling split tunneling sent only company file access through the VPN while the video call went direct, and his calls became smooth again.
At work
Carlos's remote team relied heavily on Microsoft 365 and video meetings, straining the VPN. His MSP configured split tunneling to send those cloud services directly while tunneling internal apps, then ensured every device had EDR and DNS filtering so the directly routed traffic stayed protected.
How it compares
| feature | Full tunnel | Split tunnel |
|---|---|---|
| Company traffic | Through VPN | Through VPN |
| General internet traffic | Through VPN | Directly out |
| Performance | Slower, heavier | Faster for cloud/video |
| Security inspection | All traffic inspected | Only tunneled traffic |
| Needs strong endpoint security | Yes | Even more so |
For analysts
Split tunneling boosts remote performance but lets some traffic skip corporate inspection. If you use it, make sure devices carry strong endpoint protection (EDR, DNS filtering, patching) so bypassing the network doesn't mean bypassing security.
History & origin
Traditional 'full tunnel' VPNs routed all of a remote user's traffic through the company network, which was secure but slow and bandwidth-heavy, especially once cloud apps and video calls became common. Split tunneling emerged to send only necessary traffic through the VPN. The mass move to remote work made it popular for performance, while also sparking debate about the security trade-offs of letting some traffic bypass corporate inspection.